You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Our mission at Defguard is to deliver a complete Enterprise VPN management solution for Wireguard VPN protocol, that is fully private and guarantees total control and infrastructure ownership.
13
+
Our mission at Defguard is to deliver a complete self-hosted WireGuard Enterprise VPN management solution that is fully private and guarantees total control and infrastructure ownership.
14
14
15
-
Release 1.6 marks an important step in that journey by introducing features requested by many medium and large enterprises, making large scale deployments faster, client management easier and solving a particular blocker for Microsoft Active Directory and EntraID based organisations to deploy WireGuard on scale.
15
+
Release 1.6 marks an important step in that journey by introducing features requested by many medium and large enterprises—features that make Defguard a compelling alternative to solutions like Fortinet, Tailscale, and traditional OpenVPN setups, making large-scale deployments faster and client management easier.
16
+
> **TL;DR - Key Highlights:**
17
+
> - 🔐 **Pre-logon VPN** - Connect to AD before Windows login
18
+
> - ⚡ **Zero-touch Enrollment** - Automate user provisioning at scale
19
+
> - 🍎 **macOS App Store** - Native Swift VPN with system integration
20
+
> - 🪟 **Windows MSI** - Enterprise deployment via Intune/GPO
You can support us by leaving a <ahref="https://github.com/defguard/defguard/"target="_blank">star on GitHub</a> 🙏
18
24
19
-
### Unlocking Active Directory remote authentication with VPN pre-logon
25
+
26
+
## What's new? 🚀
27
+
28
+
### 🔐 Unlocking Active Directory remote authentication with WireGuard VPN pre-logon
20
29
21
30
Organisations that use Active Directory (AD) to authenticate users on Windows machines face a significant remote access problem: AD should never be exposed to the public internet, since it was designed exclusively for intranet use. Thus, users working remotely—outside of the organisation's perimeter—cannot securely log in without risking exposure of the AD infrastructure to external threats.
22
31
23
32
The secure solution of that remote access problem is to put Active Directory behind VPN. It works only with VPNs that support establishing connection before the user logs in.
24
33
25
34
Defguard 1.6 is the first—and currently the only—on-premises enterprise VPN solution that establishes WireGuard connections before user login.
26
35
27
-
We introduced Service Locations - a special kind of locations that allow establishing automatic VPN connections on system boot and are not visible to the end user.
36
+
We introduced Service Locations - a special kind of locations that allow establishing automatic WireGuard VPN connections on system boot and are not visible to the end user.
30
39
31
40
As shown on a location configuration screenshot above, Service Location can run in two modes: "Pre-logon" and "Always-on".
32
41
33
42
In Pre-logon mode the connection is terminated when the user completes login to their system account. This way devices can securely connect to the domain and authenticate the user without the need to expose Active Directory and keep the connection time limited only to necessary minimum - authentication.
34
43
35
44
If the lack of pre-logon option for WireGuard was a blocker for your deployment, now you can give it a try with Defguard.
36
45
37
-
### Enforcing strict security with Client Traffic Policy and Always-on VPN
46
+
### 🛡️ Enforcing strict security with Client Traffic Policy and Always-on VPN
38
47
39
48
Service locations can be also configured to stay active after the user logs in by selecting "Always-on" mode. The connection won't be terminated or restarted unless the Desktop Client receives a network update or is uninstalled.
40
49
41
50
Always-on mode paired with the option to force the clients to route all traffic through the VPN allows the admin to enforce strict security policy and guarantee access to on-prem resources, preventing data leaks on untrusted networks.
42
51
43
-
52
+
44
53
45
54
> **Dive deeper with Service Locations documentation:**[https://docs.defguard.net/1.6/features/service-locations](https://docs.defguard.net/1.6/features/service-locations)
46
55
47
56
---
48
57
49
-
## Enabling Zero-touch enrollment and device provisioning
58
+
## ⚡ Zero-touch Enrollment for WireGuard Enterprise Deployments
50
59
51
60
From the outset, Defguard focused on simplicity and security of user enrollment by offering a secure enrollment portal. While convenient for smaller organisations, this approach has limitations when enrolling hundreds or thousands of users.
52
61
53
62
With the Defguard 1.6 release, we deliver the core elements necessary for automation of Desktop Client Provisioning on all platforms (Windows, Mac and Linux). On a high level:
54
63
55
-
***Windows Desktop Client** is now available as an MSI package, enabling admins to distribute the app via tools like Microsoft Intune, Active Directory GPO or other package managers (we are working on publishing to Chocolatey and Scoop).
56
-
***The macOS Client** is now available in the Mac App Store (instead of a standalone PKG installer). This enables automatic updates for users, ensures the application is reviewed and approved by Apple and enables app distribution to managed machines with MDM/UEM tools.
57
-
***All clients** now support file based enrollment configuration (the enrollment token and URL) at first launch as a universal mechanism allowing administrators to preconfigure endpoints for users with any type of provisioning or distribution tool they prefer.
58
-
* Also, we've introduced automated enrollment through Active Directory and EntraID in the Windows Client MSI installer
64
+
*🪟 **Windows Desktop Client** is now available as an MSI package, enabling admins to distribute the app via tools like Microsoft Intune, Active Directory GPO or other package managers (we are working on publishing to Chocolatey and Scoop).
65
+
*🍎 **The macOS Client** is now available in the Mac App Store (instead of a standalone PKG installer). This enables automatic updates for users, ensures the application is reviewed and approved by Apple and enables app distribution to managed machines with MDM/UEM tools.
66
+
*📱 **All clients** now support file based enrollment configuration (the enrollment token and URL) at first launch as a universal mechanism allowing administrators to preconfigure endpoints for users with any type of provisioning or distribution tool they prefer.
67
+
*🔗 Also, we've introduced automated enrollment through Active Directory and EntraID in the Windows Client MSI installer
59
68
60
69
Altogether this release provides all necessary tools for the admins to fully automate user enrollment and device provisioning.
61
70
62
71
The provisioning process is dependent on your specific environment and tooling but there are some general steps to follow:
63
72
64
-
1. Generate enrollment tokens for your users. This can be automated by leveraging our REST API.
65
-
2. Transfer tokens to end-user machines as a configuration file or in case of Windows connected with AD/EntraID store the tokens in the directory.
66
-
3. Install Defguard desktop client on end-user machines.
67
-
4. On first startup the user will be redirected to the enrollment flow.
73
+
1.🔑 Generate enrollment tokens for your users. This can be automated by leveraging our REST API.
74
+
2.📤 Transfer tokens to end-user machines as a configuration file or in case of Windows connected with AD/EntraID store the tokens in the directory.
75
+
3.💻 Install Defguard desktop client on end-user machines.
76
+
4.🚀 On first startup the user will be redirected to the enrollment flow.
68
77
69
78
This way you can achieve Zero-touch user enrollment and scalability of your deployments.
70
79
71
80
> You can find more details in documentation: [https://docs.defguard.net/1.6/features/desktop-client-auto-provisioning](https://docs.defguard.net/1.6/features/desktop-client-auto-provisioning)
72
81
73
82
---
74
83
75
-
## Defguard Desktop for macOS in AppStore with system integrations and native VPN
84
+
## 🍎 Defguard Desktop for macOS in AppStore with system integrations and native VPN
76
85
77
86
The macOS Client now integrates with the macOS system, removing the dependency on external WireGuard binaries and introducing native Swift/macOS VPN implementation.
78
87
79
88
This allows for an improved macOS usability:
80
-
* Maintaining VPN connections while switching from one network to another (e.g. changing WIFI networks).
89
+
* Maintaining VPN connections while switching from one network to another (e.g. changing Wi-Fi networks).
81
90
* Integration with System Settings and Control Center - Defguard VPN connections are now listed in system settings.
84
93
85
-
Introducing changes make App Store distribution possible and future Defguard client updates seamless.
94
+
These changes make App Store distribution possible and future Defguard client updates seamless.
86
95
87
96
You can download Defguard Desktop client from [AppStore](https://apps.apple.com/pl/app/defguard-desktop-client/id6754601166?mt=12)
88
97
@@ -94,23 +103,23 @@ To upgrade to the client, while maintaining the configuration, please follow the
94
103
95
104
---
96
105
97
-
## Defguard Windows Client with MSI and native WireGuard networking
106
+
## 🪟 Defguard Windows Client with MSI and native WireGuard networking
98
107
99
-
The Windows Desktop Client now uses a native WireGuard networking implementation based on WireGuardNT, High performance in-kernel WireGuard implementation for Windows ([https://github.com/WireGuard/wireguard-nt](https://github.com/WireGuard/wireguard-nt)). By removing the dependency on the external WireGuard binary, we were able to ship a proper MSI installer, enabling distribution through the Windows Store and standard enterprise deployment channels.
108
+
The Windows Desktop Client now uses a native WireGuard networking implementation based on WireGuardNT, a high-performance in-kernel WireGuard implementation for Windows ([https://github.com/WireGuard/wireguard-nt](https://github.com/WireGuard/wireguard-nt)). By removing the dependency on the external WireGuard binary, we were able to ship a proper MSI installer, enabling distribution through the Windows Store and standard enterprise deployment channels.
100
109
101
110
This change is also foundational for automated provisioning on Windows. All major Windows provisioning and device management solutions rely on MSI-based installers. By moving to MSI, Defguard can integrate with these workflows and execute installer-time scripts.
102
111
103
112
During installation, helper scripts can connect to Active Directory or Microsoft Entra ID to retrieve enrollment configuration automatically, enabling seamless, hands-off client provisioning in managed environments.
104
113
105
114
### Important installation and migration considerations
106
115
107
-
It's important to note that Installing the new 1.6.0 Client from the .msi will leave the previous Client version still installed. This can also cause old VPN connections to still be active until a next system restart is performed.
116
+
It's important to note that installing the new 1.6.0 Client from the .msi will leave the previous Client version still installed. This can also cause old VPN connections to still be active until the next system restart is performed.
108
117
109
118
To resolve this, before upgrading, we recommend first uninstalling the old Client. This will leave your configuration intact and it should carry over to the new Client after its installation, without the need to configure everything again.
110
119
111
120
---
112
121
113
-
## MTU settings support in all clients
122
+
## 📏 MTU settings support in all clients
114
123
115
124
On some networks - especially mobile or carrier-grade networks - the MTU (Maximum Transmission Unit) may be lower than usual. When this happens, VPN packets can exceed the network's MTU and get dropped during transmission. This often results in partial connectivity issues or a complete failure to connect to VPN servers.
116
125
@@ -120,9 +129,9 @@ As of Defguard Desktop 1.6 (all platforms) you can manually configure the MTU in
120
129
121
130
---
122
131
123
-
## How to upgrade to Defguard 1.6?
132
+
## 📦 How to upgrade to Defguard 1.6?
124
133
125
-
This release brings major changes to all components including clients, core and proxy. Upgrading all the components is required for the new feature to work.
134
+
This release brings major changes to all components including clients, core and proxy. Upgrading all the components is required for the new features to work.
126
135
127
136
As usual, we've prepared a migration guide outlining steps you need to take to upgrade your Defguard setup to the latest version.
128
137
@@ -132,19 +141,33 @@ Defguard offers Basic Support via email/ticketing system for all Business subscr
132
141
133
142
If you need additional support, please contact Sales.
134
143
144
+
135
145
---
136
146
137
-
## What's next - Defguard 2.0!
147
+
## 🎯 Ready to Deploy WireGuard at Enterprise Scale?
148
+
149
+
Whether you're managing 10 or 10,000 devices, Defguard 1.6 gives you the tools for seamless, secure VPN deployment.
150
+
151
+
- 📥 [**Start with one-line install**](https://docs.defguard.net/getting-started/one-line-install) - Get started in minutes
152
+
- 💼 [**View Pricing**](/pricing) - Plans for every organization size
153
+
- 📅 [**Book a Demo**](/book-a-demo) - See Defguard in action
154
+
- 📖 [**Read the Docs**](https://docs.defguard.net) - Full documentation
155
+
156
+
------
157
+
158
+
159
+
160
+
## 🔮 What's next - Defguard 2.0!
138
161
139
162
Defguard's future plans are centered on radically simplifying installation and day-one usability, making deployment as frictionless as possible in every scenario we can design for.
140
163
141
164
We will include a complete UI&UX redesign with streamlined component startup, clearer and more complete documentation, and eventually standardized deployment artifacts such as appliance images. While current implementation constraints limit some of these options today, removing these obstacles is a key priority so administrators can get Defguard running quickly and confidently, without deep specialist knowledge.
142
165
143
-
### Components Orchestration
166
+
### 🎛️ Components Orchestration
144
167
145
168
At the same time, Defguard aims to evolve into a true enterprise-grade vendor—positioned as a serious alternative to solutions like Fortinet as well as to SaaS offerings. The Defguard Core will become the central orchestrator for the entire platform, coordinating all components from a single control plane but still maintaining strict component isolation. This unified architecture is designed to reduce complexity, minimize configuration errors, and address one of the biggest pain points today.
146
169
147
-
### UI & UX you deserve
170
+
### ✨ UI & UX you deserve
148
171
149
172
UI 2.0 plays a crucial role in this vision by introducing a simpler, more intuitive administrative experience. While many SaaS vendors promise simplicity at the cost of privacy and control, Defguard takes a different approach: delivering even stronger security while keeping ownership fully in the customer's hands. By allowing every component to be self-hosted and controlled, Defguard provides enterprise-level security and autonomy—paired with a consumer-grade user experience that makes setup, management, and scaling straightforward.
150
173
@@ -156,7 +179,7 @@ To give you an idea what we're building, we share a preview of Edge Component (e
156
179
157
180
158
181
159
-
### Full High Availability
182
+
### 🔄 Full High Availability
160
183
161
184
And finally Defguard 2.0 will provide high-availability of all components delivering secure and scalable deployments for any type of organisation.
0 commit comments